CVE-2026-70547: Authentication Bypass Vulnerability

CVE-2026-70547 Overview

CVE-2026-70547 is a missing authorization vulnerability [CWE-862] affecting JFrog Artifactory. An authenticated user without repository read permission may access package metadata under specific conditions. The flaw allows a low-privileged, authenticated actor to enumerate package metadata that should remain restricted to users holding explicit repository read entitlements.

The issue is network-exploitable and requires no user interaction. Impact is limited to confidentiality of metadata; integrity and availability are not affected according to the CVSS vector.

Critical Impact
Authenticated users can retrieve package metadata from repositories they are not authorized to read, exposing information about internal software components, versions, and dependencies.

Affected Products

JFrog Artifactory (self-managed) — refer to vendor advisory for exact versions
JFrog platform components exposing package metadata endpoints
Deployments where users hold platform authentication but lack repository-level read permission

Discovery Timeline

2026-08-12 - CVE-2026-70547 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70547

Vulnerability Analysis

The vulnerability stems from a missing authorization check on package metadata retrieval paths within JFrog Artifactory. Under specific conditions, the service returns metadata to authenticated principals without verifying whether the caller holds the repository-scoped read permission required to view that content.

Metadata exposed through this class of flaw typically includes package names, version histories, artifact identifiers, dependency graphs, and upload timestamps. This information supports reconnaissance for supply chain attacks by revealing internal software inventories, private package names, and version drift across environments.

The attack requires valid platform credentials, so exploitation is limited to insiders or attackers who have already obtained an account. However, low-privilege accounts are common in large Artifactory tenants where hundreds of developers, build agents, and CI service principals authenticate against the platform.

Root Cause

The root cause is an authorization gap classified as [CWE-862] Missing Authorization. The affected code paths validate authentication but omit the repository-level permission check that governs metadata visibility. The vendor advisory notes the condition is triggered under specific request patterns rather than for all metadata queries.

Attack Vector

An attacker authenticates to the Artifactory instance using any valid account, including service accounts or read-limited developer accounts. The attacker then issues metadata requests against repositories the account should not be able to read. Successful requests return package metadata that bypasses the repository access control list.

No verified public proof-of-concept code is available. See the JFrog Security Advisories for authoritative technical detail and reproduction conditions.

Detection Methods for CVE-2026-70547

Indicators of Compromise

Authenticated API requests to package metadata endpoints from accounts that have no assigned read permission on the target repository
Unusual enumeration patterns where a single principal queries metadata across many repositories in a short window
Access log entries showing successful 200 responses on metadata paths for repositories not present in the caller's permission target set

Detection Strategies

Correlate Artifactory access logs against the platform's permission target configuration to identify metadata reads that violate the assigned repository ACL
Baseline per-user metadata request volume and alert on deviations, especially from service accounts and CI principals
Monitor for sequential enumeration across repository names, which suggests scripted reconnaissance rather than normal developer activity

Monitoring Recommendations

Forward Artifactory request.log and access.log to a centralized SIEM for authorization-aware analytics
Enable audit logging for permission target changes and metadata API endpoints
Track authentication events for low-privilege and dormant accounts that begin issuing metadata queries

How to Mitigate CVE-2026-70547

Immediate Actions Required

Review the JFrog Security Advisories page and identify whether your deployed Artifactory version is affected
Inventory all authenticated principals, including service accounts, and revoke credentials that are unused or over-provisioned
Restrict network exposure of the Artifactory management and API interfaces to trusted segments only

Patch Information

JFrog publishes fixed versions and remediation guidance through the JFrog Release Documentation and the JFrog Security Advisories portal. Apply the vendor-supplied update for your Artifactory edition and deployment topology.

Workarounds

Enforce least-privilege permission targets so no account holds implicit access beyond its required repositories
Disable or rotate legacy authentication tokens that predate current permission model changes
Place Artifactory behind an authenticating reverse proxy that logs and rate-limits metadata endpoint access until the patch is applied

bash

# Configuration example - audit users with platform authentication but no repository read permission
# Run against the Artifactory REST API to enumerate principals for review
curl -u admin:$ARTIFACTORY_TOKEN \
  -X GET "https://artifactory.example.com/artifactory/api/security/users" \
  | jq '.[] | select(.groups | length == 0) | .name'